Last active
October 18, 2019 06:47
-
-
Save yigityus/611fb7a54d97bd0bac317612686f71cd to your computer and use it in GitHub Desktop.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| import org.springframework.security.web.authentication.preauth.AbstractPreAuthenticatedProcessingFilter; | |
| /** | |
| * https://stackoverflow.com/questions/48446708/securing-spring-boot-api-with-api-key-and-secret | |
| */ | |
| public class APIKeyAuthFilter extends AbstractPreAuthenticatedProcessingFilter { | |
| private String principalRequestHeader; | |
| public APIKeyAuthFilter(String principalRequestHeader) { | |
| this.principalRequestHeader = principalRequestHeader; | |
| } | |
| @Override | |
| protected Object getPreAuthenticatedPrincipal(HttpServletRequest request) { | |
| return request.getHeader(principalRequestHeader); | |
| } | |
| @Override | |
| protected Object getPreAuthenticatedCredentials(HttpServletRequest request) { | |
| return "N/A"; | |
| } | |
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| @Configuration | |
| @EnableWebSecurity | |
| @Order(1) | |
| public class APISecurityConfig extends WebSecurityConfigurerAdapter { | |
| @Value("${yourapp.http.auth-token-header-name}") | |
| private String principalRequestHeader; | |
| @Value("${yourapp.http.auth-token}") | |
| private String principalRequestValue; | |
| @Override | |
| protected void configure(HttpSecurity httpSecurity) throws Exception { | |
| APIKeyAuthFilter filter = new APIKeyAuthFilter(principalRequestHeader); | |
| filter.setAuthenticationManager(new AuthenticationManager() { | |
| @Override | |
| public Authentication authenticate(Authentication authentication) throws AuthenticationException { | |
| String principal = (String) authentication.getPrincipal(); | |
| if (!principalRequestValue.equals(principal)) | |
| { | |
| throw new BadCredentialsException("The API key was not found or not the expected value."); | |
| } | |
| authentication.setAuthenticated(true); | |
| return authentication; | |
| } | |
| }); | |
| httpSecurity. | |
| antMatcher("/api/**"). | |
| csrf().disable(). | |
| sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS). | |
| and().addFilter(filter).authorizeRequests().anyRequest().authenticated(); | |
| } | |
| } | |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment